Complaints

The complaint text that is displayed might not represent all complaints filed with BBB. Some consumers may elect to not publish the details of their complaints, some complaints may not meet BBB's standards for publication, or BBB may display a portion of complaints when a high volume is received for a particular business.

• Initial Complaint

  Date:07/10/2023

  Type:Product Issues
  Status:

  UnansweredMore info

  Complaint statuses

  Resolved:

  The complainant verified the issue was resolved to their satisfaction.

  Unresolved:

  The business responded to the dispute but failed to make a good faith effort to resolve it.

  Answered:

  The business addressed the issues within the complaint, but the consumer either a) did not accept the response, OR b) did not notify BBB as to their satisfaction.

  Unanswered:

  The business failed to respond to the dispute.

  Unpursuable:

  BBB is unable to locate the business.

  This business seems to be *** based (********** address, ******** incorporation) but with a significant overseas tech team, likely the vast majority of their actual implementation of their product is done overseas.This is only relevant because when managing any team, but especially an overseas software team when processing *** of US persons, it is often the case with a small company such as this to not really be aware of implementation specifics and also possibly not processing said *** in accordance with US regs or consumer expectations.They seem to have a foothold in a handful of boutique hotels, one of which I recently transacted with using a card I only used for this purpose, using other cards for the duration of the trip. Upon discovering someone had used my card info to make ~$200 in unauthorized purchases I became suspicious of the hotel and its software, which this company is responsible for.Regardless of this company's culpability re this specific event, upon doing a test transaction (subsequent to the discovery of fraud) on a white-labeled website this company is responsible for (ie their software used to book at one of their client hotels) I found they ingest financial *** directly on their servers, meaning they do not hash, encrypt, or even attempt basic obfuscation of the *** payload, including credit card info in plaintext. While I understand they implement SSL in transit, this is not enough and anyone who has processed a card transaction online knows or should know that a small company like this should not be ingesting financial *** directly, instead they should be making an embedded call to a reputable service like PayPal or Stripe or some banking institution with an actual reputation and proper security practices. Given this glaring oversight it's likely they also allow their clients or even employees access to plaintext *** payload (such as card information) which can facilitate fraudulent behavior and even possibly identity theft.